One-page incident response plan
Decide before it happens.
Who to call, who decides, and how customers are told. A fill-in template you can finish in an afternoon.
One-page incident response plan
When something goes wrong, such as a ransomware message, a compromised email account, or a lost laptop, people tend to freeze or improvise. A short written plan turns the first hour from chaos into a checklist. Fill in each section below, print it, and keep copies where people can find them even if your systems are down.
1. What counts as an incident
Examples: a suspected phishing click, an account sign-in you do not recognize, ransomware or a locked screen, a lost or stolen device, an unexpected outage, or a call from someone saying they received strange messages from us.
2. Who to call first
3. Who decides
4. The first hour
- Write down what you see and when, including times and screenshots if possible
- Disconnect affected devices from the network, but do not turn them off unless told to
- Do not pay a ransom or reply to a demand before talking with your decision-maker and advisors
- Call your IT or security provider
- Change passwords for affected accounts from a different, trusted device
- Notify the decision-maker
5. Communication
Decide in advance who talks to staff, customers, vendors, and, if needed, regulators or the media. Staff should know to send questions to one person.
6. Keeping the business running
7. After it is over
- Record what happened and how it was resolved
- Find the cause and fix it
- Update this plan with what you learned
- Tell staff what changed
Practice it
Once a year, read the plan aloud with the people on it and walk through a made-up scenario. It takes thirty minutes and shows you what is missing.
Want help putting this guide into practice?
Our team can walk through it with you and tailor the plan to your organization.